fix: FAQ CJK glyphs, outgoing-tx history, lite encryption, migrate & sync safety

Bug-report fixes plus adversarial-audit follow-ups. Bumps full 2.0.1->2.0.2 and
lite 1.1.0->1.1.1.

i18n / fonts:
- Rebuild the NotoSansCJK subset with the glyphs the FAQ back-fill introduced
  (什/么/门/做); Chinese FAQ titles rendered as "??" on zh (and ja/ko).

Transaction history (enumeration gaps):
- Surface outgoing shielded z->z sends via z_listsentbyaddress (listtransactions
  and z_listreceivedbyaddress never report them).
- Surface z->t deshields by parsing z_listsentbyaddress transparentSends (which
  z_viewtransaction does not expose); dedupe t->t against listtransactions.
- Key send-row dedup on address so equal-value multi-output sends aren't dropped.

Lite wallet (key safety):
- The async create/restore/open path the UI uses now applies the passphrase:
  encrypt a new/restored wallet, unlock an existing one. It previously discarded
  the passphrase, storing the seed/keys in PLAINTEXT (create/restore) or leaving
  an encrypted wallet locked (open).

Migrate-to-seed (fund safety):
- Persist a sweep-submitted marker at broadcast so a resumed migration can't treat
  a ~0 balance (an unconfirmed in-flight sweep) as an empty wallet and adopt (swap
  wallet.dat) before the sweep confirms; best-effort locate routes to the confirm gate.

Sync / threading:
- Gate isSynced() on a peer-derived tip (tip_known) so a peerless node isn't reported
  synced (Send against a stale balance); add a "no peers" status banner.
- Guard daemon_status_ with a mutex (monitor-thread write vs UI-thread read).

Tests: extends tests/test_phase4.cpp across all of the above; suite green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwycPDQSfEKtrTS2uC4JeT

src/data/seed_migration_resume.h

@@ -34,4 +34,12 @@ inline MigrationResume decideSeedMigrationResume(bool pending,
     return MigrationResume::SweepGate;
 }
 
+// At the Sweep step with a ~0 legacy balance, may we offer the direct "no funds -> adopt" short-cut
+// (swap wallet.dat immediately)? Only when NO sweep has been submitted — a genuinely empty wallet.
+// If a sweep WAS submitted, a ~0 balance is ambiguous: the sweep tx may be unconfirmed in the mempool
+// and could revert on a drop/reorg, so adopting now can strand the funds in the moved-aside backup.
+// In that case adopt must go through the confirmation-gated path (>=1 conf) instead — never swap
+// wallet.dat on an unconfirmed sweep. (fund-safety: audit)
+inline bool sweepGateMayAdoptEmptyWallet(bool sweepSubmitted) { return !sweepSubmitted; }
+
 }  // namespace dragonx

src/data/wallet_state.h

@@ -149,7 +149,13 @@ struct SyncInfo {
     float witness_progress = 0.0f;  // 0.0 - 1.0, within the current sub-phase
     int witness_remaining = 0;      // blocks left in the cache walk (0 if unknown / phase 1)
 
-    bool isSynced() const { return !syncing && blocks > 0 && blocks >= headers - 2; }
+    // True only when the daemon reports a positive peer-derived tip (longestchain > 0). A node with
+    // no peers reports longestchain == 0, so `blocks` is then only the LOCAL best height and cannot be
+    // trusted as "at the network tip". isSynced() gates on this so a peerless / cold-started node is
+    // never reported synced (which would enable Send against a stale balance). (audit: peerless-synced)
+    bool tip_known = false;
+
+    bool isSynced() const { return tip_known && !syncing && blocks > 0 && blocks >= headers - 2; }
 };
 
 /**